EUVD-2026-62507
GHSA-63v3-36f6-6w34
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector confirmed by description; low privilege sufficient; no user interaction; full CIA impact via privilege escalation to system context.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
AnalysisAI
Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 on local systems. A low-privileged local attacker can exploit unsafe deserialization to execute arbitrary code at a higher privilege level, potentially gaining full system control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with at least low-level system privileges (standard Windows user) - PR:L per the CVSS vector confirms authentication is required but no elevated role is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High) and accurately reflects local, low-complexity exploitation requiring only a standard user account with no user interaction - a realistic threat model in any multi-user or shared endpoint environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A standard domain user logs into a Dell corporate laptop running DCU prior to 5.7.1 and writes a crafted serialized payload to a location read by the DCU process. When DCU deserializes the payload during a routine update check or scheduled task, the gadget chain executes arbitrary code in DCU's elevated process context, granting the attacker SYSTEM-level privileges. … |
| Remediation | The primary remediation is upgrading Dell Command Update to version 5.7.1 or later, which is the fix version indicated by this advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct a complete inventory of all systems running Dell Command Update versions prior to 5.7.1; restrict local logon privileges to only authorized personnel and audit current access grants. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Dell Command Update Dcu
View allPrivilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to gain
Elevation of privileges in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a low-privileged local att
Incorrect Default Permissions in Dell Command Update (DCU) exposes a local privilege escalation path on all versions pri
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to f
Missing Authorization in Dell Command Update (DCU) versions prior to 5.7.1 permits a low-privileged local user to invoke
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 is achievable by a local low-privileged atta
Local privilege escalation in Dell Command Update (DCU) versions prior to 5.7.1 allows a low-privileged local attacker t
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-pri
Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 allows a local low-privileged attacker to ga
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, con
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today